hxxp://linksterr[.]com/r/so4eyn/

Analysis

user interaction
yes
max time kernel
362s
max time network
361s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://linksterr.com/r/so4eyn/
Sample260816-fp73ra1tht

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1128	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313302496174752"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EE8A758A-3915-42EF-AD86-2A0CBEA0D0D5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{A28F2B82-D3F3-4D40-9EAE-37E857DF865A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
224	msedge.exe
224	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2216	3020	msedge.exe	86
PID 3020 wrote to memory of 1128	3020	msedge.exe	87
PID 3020 wrote to memory of 2532	3020	msedge.exe	88
PID 3020 wrote to memory of 2532	3020	msedge.exe	88
PID 3020 wrote to memory of 2532	3020	msedge.exe	88
PID 3020 wrote to memory of 5108	3020	msedge.exe	89
PID 3020 wrote to memory of 5108	3020	msedge.exe	89
PID 3020 wrote to memory of 1324	3020	msedge.exe	90
PID 3020 wrote to memory of 4468	3020	msedge.exe	91
PID 3020 wrote to memory of 1324	3020	msedge.exe	90
PID 3020 wrote to memory of 1324	3020	msedge.exe	90
PID 3020 wrote to memory of 4468	3020	msedge.exe	91
PID 3020 wrote to memory of 4468	3020	msedge.exe	91
PID 3020 wrote to memory of 1500	3020	msedge.exe	93
PID 3020 wrote to memory of 1500	3020	msedge.exe	93
PID 3020 wrote to memory of 1500	3020	msedge.exe	93
PID 3020 wrote to memory of 4084	3020	msedge.exe	94
PID 3020 wrote to memory of 4084	3020	msedge.exe	94
PID 3020 wrote to memory of 4084	3020	msedge.exe	94
PID 3020 wrote to memory of 4736	3020	msedge.exe	97
PID 3020 wrote to memory of 4736	3020	msedge.exe	97
PID 3020 wrote to memory of 4736	3020	msedge.exe	97
PID 3020 wrote to memory of 2740	3020	msedge.exe	99
PID 3020 wrote to memory of 2740	3020	msedge.exe	99
PID 3020 wrote to memory of 2740	3020	msedge.exe	99
PID 3020 wrote to memory of 1476	3020	msedge.exe	100
PID 3020 wrote to memory of 1476	3020	msedge.exe	100
PID 3020 wrote to memory of 1476	3020	msedge.exe	100
PID 3020 wrote to memory of 2584	3020	msedge.exe	101
PID 3020 wrote to memory of 1888	3020	msedge.exe	102
PID 3020 wrote to memory of 2584	3020	msedge.exe	101
PID 3020 wrote to memory of 1888	3020	msedge.exe	102
PID 3020 wrote to memory of 4492	3020	msedge.exe	104
PID 3020 wrote to memory of 824	3020	msedge.exe	107
PID 3020 wrote to memory of 824	3020	msedge.exe	107
PID 3020 wrote to memory of 824	3020	msedge.exe	107
PID 3020 wrote to memory of 4792	3020	msedge.exe	111
PID 3020 wrote to memory of 5088	3020	msedge.exe	112
PID 3020 wrote to memory of 1312	3020	msedge.exe	113
PID 3020 wrote to memory of 3964	3020	msedge.exe	114
PID 3020 wrote to memory of 3964	3020	msedge.exe	114
PID 3020 wrote to memory of 3964	3020	msedge.exe	114
PID 3020 wrote to memory of 4624	3020	msedge.exe	115
PID 3020 wrote to memory of 4624	3020	msedge.exe	115
PID 3020 wrote to memory of 4624	3020	msedge.exe	115
PID 3020 wrote to memory of 4948	3020	msedge.exe	116
PID 3020 wrote to memory of 4292	3020	msedge.exe	117
PID 3020 wrote to memory of 4292	3020	msedge.exe	117
PID 3020 wrote to memory of 4376	3020	msedge.exe	119
PID 3020 wrote to memory of 4376	3020	msedge.exe	119
PID 3020 wrote to memory of 4220	3020	msedge.exe	120
PID 3020 wrote to memory of 4220	3020	msedge.exe	120
PID 3020 wrote to memory of 4220	3020	msedge.exe	120
PID 3020 wrote to memory of 4736	3020	msedge.exe	121
PID 3020 wrote to memory of 4736	3020	msedge.exe	121
PID 3020 wrote to memory of 4736	3020	msedge.exe	121
PID 3020 wrote to memory of 224	3020	msedge.exe	129
PID 3020 wrote to memory of 1528	3020	msedge.exe	130
PID 3020 wrote to memory of 1528	3020	msedge.exe	130
PID 3020 wrote to memory of 4652	3020	msedge.exe	131
PID 3020 wrote to memory of 4800	3020	msedge.exe	132
PID 3020 wrote to memory of 4800	3020	msedge.exe	132
PID 3020 wrote to memory of 4652	3020	msedge.exe	131
PID 3020 wrote to memory of 4756	3020	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://linksterr.com/r/so4eyn/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff5387c188,0x7fff5387c194,0x7fff5387c1a0
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,12097193541064795522,1833852444273372454,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14838288874063617041,17420485960085823526,262144 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,1644874297929854458,14239494972982499815,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,14087985455873728309,17072501736513505110,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,4041058579840602346,17829437978396234136,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,14925380512494262192,13489448234719365487,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,11314597747146417197,16479859397616755596,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5048,i,9931167833914335435,5043109528297884099,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5232,i,13488866442415823305,12261951326368043695,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5480,i,3771842320870376752,1207943610472279024,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,16826103172993012985,10633207833433142528,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,6899853221427217576,12003768248407579284,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,11273337700427762242,12572591678466964741,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,11273337700427762242,12572591678466964741,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6664,i,10445667527708179194,5735609306176027491,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,3537499627012195002,4775242571892628664,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,3693777295253338691,18234750731969439008,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,17055842770600782610,15174045907535485414,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5184,i,3457131939623127618,3857069602360887863,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5352,i,526039776249268314,729750585037875601,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,241253615084148773,932573205958185842,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,10577786555083604240,11234708241742874591,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,4943956078920125292,14265116088197078667,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7212,i,13658959734247818531,11900552411304567146,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7428,i,6051825339685247665,9190611487653166211,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7216,i,15849552078671334691,8311158994890252119,262144 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,13275468019013636313,8203286990848757233,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,16231688927305811005,15363048325639026304,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,13992292829408909243,5538302740129816160,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,12417778329308344638,13972918311174261116,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5848,i,15605096737033104523,3358815209753024471,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5640,i,11228000519651278787,5595519602752037330,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7812,i,2008815376218770322,15905929212146436185,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8064,i,3633669502483734394,10836591745990558873,2097152 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,2067995257556280115,4208294570260763506,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,6633004539451227135,5566646794093508295,524288 --field-trial-handle=2968,i,17603756557570800605,982548748412268866,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

50840025-aee0-4ba5-8948-4ee178a132fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50840025-aee0-4ba5-8948-4ee178a132fc.tmp
Size 12KB
SHA256 da5996150dc01f0b7467be48e0b3e0c2f02e44da7e42ec380f2391c94d1e3b3e
MD5 ad027a234734aab845eab31f710b1877
SHA1 3459dec24041a02b722f96fcdb944bb5508ed878
SHA512 39dfb12715207502c31a338a4ca3d95354f8415f48afabc5bf8ae45bd2ebac21ef227ab61ddc26f82224dfaadb7a62b095819ea626e65530732206a4b749a833
SSDEEP 192:sxZsRXyM/jK1Ml8Mkd/fFs5HqVCZ8IdpOk1HW6+WNNCZ/Yz6jy/IgrJ:sxZsdMd/fFs8VCPzHb+/Y9
TLSH
T11352E911AA346977CCDBD209F945BF53D6F5157291A00E44AAFCCA1C04E7AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ae2554910235155bc28cecbd7dbe60def1dccd88d9b03bc5f820f04af0e96e83
MD5 e0a91e6dacddb5d2e5d87746e69800c9
SHA1 7b9354d2f7e098316b87b4bdc82a3c6b1a315292
SHA512 23dad102e87b4c05b2e5c15db67f01afa0c222143e0b6a9d07f813d39538d3cccd099a5752eb2f40d34ea5e2b332217cd96002f190f868c39d5d9c87307cb6f9
TLSH
T177E0269404CAC7BEAB40B5E7D264838CC281374BA3C8B90A1B4489C8F0036D4A3C75D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d4a0ff6b66648f16bb936094c09f55abe4e84fbbdf65d9c237169b56086f9b6d
MD5 d0c65c0956e5241dae2d0f1035616aee
SHA1 dbb504752ebb5f44a3b0ee8a5e1382d140b933d7
SHA512 d4e01712cdf246792482f1d8ff72d41ef59348bebacb5547dcbf7712f94a1ddfb039670c7af2dce8294a1250bd0b4ddd7e8ca2e8b6026e422c2dfb526b97f487
TLSH
T112E0688402C2D5E02DA3B2C7F00863CB4C21E781F78DE47563C8A0CCD080100A303190
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 337561159305cce7cf2e92538d2c0c6389c3b8f710a4017344fd88b4a89d9205
MD5 765dafe96d0c034434f160155bdcc56c
SHA1 6a3d47a6cd822d2bc55570d4862d483cb6e7b557
SHA512 08e603cca7280acc0a2e759a74bbde5051809bedd9c3c2d50360002ff7e758132b050f80367a38b41b18e27ec028b94cec9b9b5fedcd0d6af0963f005e82f971
TLSH
T1B881D838D15301A5DB3D01B8B1CD112C34FB99E9FEAB1E858CD56B7674323D0A39825C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 fc5cc1ded00bdd35a3125c8c1ba02cb8c8d737d916c52ed804d66e823f4e5915
MD5 f792dddd72a2e0f2086d227fef18a588
SHA1 da1bfb86d9f12f84fadeef2cad5eaa042346192d
SHA512 ef6f3b1f2c8cf1a494ea3bff2edadf4579ced74e538adf79217c1e32fc87ead2a211f0464114364167660d8993d62880d2cfec971054329e633199dfaddb2a5a
SSDEEP 48:J7Vx+IPlubJqNLLGnFmRcRtx6ClPHEJhqicmDg15jmfCuu6F8WaE8DeS/:Vdubg+F+ct6C+JhqicmDg1hmfHN8SS/
TLSH
T1AC81C738D19305A5DB6D01B8B5CD112C34FF8AE9FEAB1E858CD56F7664323E0A398258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 767119e4b3aef82790641c0021cfffd63d734b56a49e48aff2fe8d40045c1ce3
MD5 69f7001b8d97bc7b522e0f8627746af5
SHA1 025ed1cded59f7f33f0211dbd454fa52c57a3640
SHA512 3215dbce2a93e76307c1a436cb0217641e6f4364615b6e2c897ff6ac9d046265d1b575615ceded228359766deb9398d8993baec8a1ee51f28096bcdd412939d4
TLSH
T1F981C739C20301A5DB2D01B8B1CD112C74FB99E9FEAB1E968CD56B7674323D1E39925C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_linksterr.com_0.indexeddb.leveldb\000003.log
Size 582KB
SHA256 a4bef89b3d1930c747e82d48d88cb8a64c36ca22656ed772a2746b33f0157d22
MD5 092de760673ac15c214f0f833045bad1
SHA1 62e540006fe7cafa548741d03c3cd4dc011e7483
SHA512 5b2716d5f57456c0767a8fd3a7840d49c3351b63dde3bece2f143fc6d48e18e7afb7ec97e054eeefe864822fbfcda467ebb299c722f38c23ecccc08f6789f0e8
SSDEEP 3072:qufExKKEh2TCjA1Pg/YeTsYz/AAduIyxpGciZ2UrMRSHjUn57Htt9HSpPhfPllu6:zPWqF7+lDo9vgKeTNL1fdBa
TLSH
T1BDC43866AF9BDE1BF0144A3188695FCEEB1BEE82BD04551BF0C43B985EB37C44C50A46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_linksterr.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_linksterr.com_0.indexeddb.leveldb\LOG
Size 347B
SHA256 0d0ee7fe06191b04aa32832ef338f391101638abd4f31507ab74bacebed5ccea
MD5 0e6e8495c068e2c76eff35d87f78034d
SHA1 2205ec2babee1364c3d434af403e1441f65adbfb
SHA512 d1a91e26c6ad40109dfe53537b05924ff2ba1617d15a3e2904b27f092dc79e88dae797c336cc6ca780e89c9d15950f166590e2bb68b0fd6a94897e0d249fa0c8
TLSH
T11BE06838C5CAC51B352020D694347B8EC5A7664EAADCBD424F80D818F0431C4D23F690
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_linksterr.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 79c364757f7ed69bb5520767a3c1544ef05bf9d9be8e9150f8e86044b0785130
MD5 9954a594c65c71e8d6264842d0f50f08
SHA1 2fdba45830aa9b97ac26d9365329e02f4262933b
SHA512 e1326d25304608f795df902f3cd29576e21f5d072a7a534cb0ed8682777b26ba47e6aad91033970356204d59a6d2869fd410839ff55bb7bcbd206266f63b0f49
SSDEEP 192:DDpd3FewouJS8JfeRTJkHm7XDlgn6GAuxAuQg0bx4CCdBDYy88v51BVC+i28iN16:DDpd3FewouJSYf+TJkHm7XDlgnlAgAtF
TLSH
T11B32AFF7C7E6996ED9051AF25618EE2BCF1C0615422C3C268DD8FEC793D2872E24154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 adbdff89d1b86caa58f2604a426aa234448179554b85f2be68e529fe3d81ab0e
MD5 a7847e4a6880a109dbc4a3a18bb67368
SHA1 9b94b489b4bde781d822e52a57ef74a166b77b1c
SHA512 ffc4b9ff94312f05ef9b3afed3334e5a3e75445089c1605f8919ca4672a7be1291cb2824c415d74c668e70f5ff96f6cdf830c80e67fde721d5857941a6ce2407
SSDEEP 192:DDpd3FewouQS8JfeRTJhUXzDlgn6GAuxAuQobx4CCdBDYy88v51BVC+i28iN1jOu:DDpd3FewouQSYf+TJhUXzDlgnlAgAtog
TLSH
T129329FF7C7E6996ED9051AF25618EE2BCF1C0615421C3C268DD8FEC793D2872E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1bfc33dca5279fe099a6b71b22c8344f688d32a74a969a7b82b78c37ce8d3ebb
MD5 0139c63e6244e16cdd97f2301dcc0703
SHA1 4b5da6fcb43617c073526d655118fcf2ee56cacd
SHA512 5ca191e6038ec309b15662c29a2887a203e3f4ce4ad069541525bb154dc60166ba917d9a1e851d1d107c14a5ade6b3efb05530ae5c617ffb8f28939187f903ea
SSDEEP 192:sxZsRXyM/jK1Ml8Mcd/fFsuHqVEQ8IdpskBFHW6+WNN+bdYzfzy/Ig5BJ:sxZsdUd/fFsdVEejHb2dbR
TLSH
T17152D812AA3469778CDBE209FA45BF53D6F5147292640E44AAFCCA1C04E7AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3f57d5371a29113637ba72a2417756da993f4f86e35b1525be1ee0a068af4451
MD5 4195fab3d977ed23bcf56194ce656872
SHA1 7da4ce93d53ab0db9d491295eece3a74072b5842
SHA512 664d7fca86e3b85312a49976811e0b7a2614bb3f447794eae00cfe62f694be12a2c717f07603e2082abc68d437a48768a1eae9e656a908375c462510180beb4a
SSDEEP 192:sxZsRXyM/jK1Ml8Mfnd/fFsuHqVEQ8IdpsxJdBFH226+WNEOkVSxYzQzy/Ig5BJ:sxZsd3nd/fFsdVEesHiEWxuR
TLSH
T14562C852AA346977CCDAE209F945BF53D6F5156292A01D84AAFCC91C04E7BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b738cfc5d86e6cdef661dd78c66b8b80d089e68818262f2eb2101b65070e262c
MD5 ddb21bedff0ff8b4b3e26aecb18a344b
SHA1 dac8a426a6b22d5539e729cb704d0a49a7ad9408
SHA512 673bc9a71e459f5bfd09923e4e36f4bdeb11717132f77ae06a012e75ab0a2cc814900edff9db76171e885f26964cd28bb92b7ea62f3aeb2264a3f19bc6f5bbee
SSDEEP 192:sxZsRXyM/jK1Ml8UQd/d/fFsuHqVEQ8IdpsxJd9H226+WNBgOkyydYzDzy/Ig5BJ:sxZsdqxd/fFsdVEeSHiSldvR
TLSH
T1C262C752A63469778CDBE20DF941BF93D6F4556292A00D84AAFCCA1C04E7BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9080b17fdf56767b56411b6b3da843481d90c5c2e60bf43d1b6e4fb70fdee36a
MD5 189ea6ccb84799be24bad087d0139792
SHA1 8f64fc50fd793f0a76a7b55d7455022613f6e6be
SHA512 35a7073b9a134053566ce5321d935647e72427e363a2207d57a74784080a76f987cf0163252e3d9e74b23b989b450f98366985f710e57c959cf8e6d61f5e082f
SSDEEP 192:sxZsRXyM/jK1Ml8UQddd/fFsuHqVEQ8IdpsxJdBFH226+WNEOkKBNYzrzy/Ig5BJ:sxZsdqvd/fFsdVEesHiEaNTR
TLSH
T1F662B852A63469778CDBE20DF941BF93D6F5556292A01D84AAFCCA1C04E7ADD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ef9b14c8c545dcb8d0ea73d4094a0b8b272978430fb28da62f9089a7930467a3
MD5 6a60ab62dfda94b958b73083a5e3c12d
SHA1 a9ad4c3d17233c06be0529944aead5948d5fd116
SHA512 9d17a798a12ba98ea542279ebb280931c6cc4d1890d0e5e374cd82c50e5a74950e990309f25d2ea815bc53ed024d66b5b8bfe18337081d5ede7d12fb652206db
SSDEEP 192:sxZsRXyM/jK1Ml8UQdfnd/fFsuHqVEQ8IdpsxJdBFH226+WNEOkpOXYz0zy/Ig5L:sxZsdqJnd/fFsdVEesHiEyXaR
TLSH
T15962C852AA3459778CDBE209F941BF93D6F5157292A01D84AAFCCA1C04E7BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 10e439529a7fe3c9ac36740bb7b0bb1435758280597d2090ef856f35004e192a
MD5 779055c0e251a56176b7e6312e9245e6
SHA1 8eeabc8b840d8a06eb813e80cee8841216dba4fc
SHA512 1473d122462daf91ed3a7456bd2fa628e078094efcf8a019cf3c0044615a9a08dbd51e3be2283dd9ca1bfe3b0e3562ba1f77342c94a6b7dfa01dd9722943f533
SSDEEP 768:XqW7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj+roII0HYx:XqW7kf0Wvqinau1jaa5LA3jVpx
TLSH
T155E2FA3B680CCB7E4F840E5CEC266F966ED801CB669889544BFA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 d476cca66c099ff1480b00e552e065df4154d801ac449e5b173e7be2f14f7d4e
MD5 56bc8c0cd7eb38ecce19c13413a627eb
SHA1 50b14f3838ec0ea2fb1a88142411bdedbfe32276
SHA512 d3420a1b3881fa40fdefa381cca42ca8628bfc7f8f6b9145a37a3ca0e803856eb0079f2b92435e5007c2abda038b9f6ff10a7986df6836f2f0f77973384c426a
TLSH
T1FE2161484EE08A2FE9A841B315B7A4E4B370D8DD5322B7A35C3C31302D13749394B1CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cfc88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5cfc88.TMP
Size 1KB
SHA256 6506afd8c7d88b5eaba2e17f00b47ca7ef923061b28cb0de5d21d18e464c591f
MD5 7d0d2994e9872041b59871e51fe119fe
SHA1 fb5b0e636bb4c4757a609ef465b459b5e984a666
SHA512 42005b2c1a64af77ea2cdfdae8e5a4cdd4b775238f95b758e569569ce5d71e42350d65f47c276744996c36a4037b36feeebda1ef39e9fbed782b27410b8cf6fc
TLSH
T18921449586E18E0BFD84517B1A93B4F8B3308C009322F7D3697C26798D35B8E1A4B0CA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4bd1cc5f56bb6a116327bda45bcb1e398b90767314002fd36422ae2f45d0010d
MD5 fa8acc13d56723b62aed2459b1cda124
SHA1 9ca85ffe98b4f4115c09e8a773a5589398a8a51f
SHA512 21e62e59e637ce042d5db92486e951b3ca36b2a854519a32787632b01ba6b68f58b941d5565d091455787d85e3f4f0fe193d4612827e6d9924e1ded22773e57e
TLSH
T149E068BB2DFB1820AC6F87C138B154A0C1963918D500EC0E3027B28730F2751240AC25
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 731e9121a31a847727af66a7e23aa5de66c002e4027e29c050550afd3d6b6550
MD5 b178411c01f6e40ee5f89c1636df7bb6
SHA1 00b8064c9552f23ae237cb21bf598f593e20a52b
SHA512 dd7c5d8834b3a7010290e2a3baf31093d1ebf6f4a46a8dbd4a7ba5a4b20320ab3cf721f74fa74ee03b398b676e56a5c989bbe431f68aa41d400a1efd2a5dded7
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTjNIdKeQAXyhIIXKJukJ0IrKRb:KIbCKcjNmKeQqCIwKJuy0AKRb
TLSH
T14A913242753B46513CBF2988929ECB365E4236633418E87F7BB854A25E67E110DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f07f9620d2071ba0284f1d2508414e7037af5c26e045d7847cb692a6ab7356b2
MD5 02d57d6fad80161f144df864df3a2803
SHA1 283ec51801e10bf054bc1429405a54f1418d15da
SHA512 c05ca01bd0babedf9c599eb22234ff69157e48917c859da8ebd6906e6ee83a5256bddc5b416220972bf2f9e6f58abba6e1e3041a83e85effa45163d55c3d0946
SSDEEP 384:NiFbZcIWsNM8TUNTUlIR0xRbtJ2P+GdpqClOOPrXLpe8C/rtm:EFDWZwgMR/s15lOi9PWtm
TLSH
T12FD23AF158E7993AE96EAB43E77D2E028EBCC127B5805684B3DC990CCD9617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f785d7fd2d3352ef592cab7bd00df643b51423b7e8f810420ebdbbe9cb373462
MD5 481ae4aef0c5b13130de6dd23010bbab
SHA1 cd8a3f15f873b433703e74573c3a928bc932401b
SHA512 e2528f113f17234d41168e4f7a1b7ad45499a9cec02ac1f8a6166d1a22e3bc8c461123f9879bdbb242c03508eeaa336835efc1c6a832c9cb4b84a8147c23e251
SSDEEP 384:NiFiZcIYsNU8TUNTUlIl4SRbBj2EGdpq8lOOPrXLpe8C/rtm:EFQYlwgpRtE5lOi9PWtm
TLSH
T14AD23BF158E7593AE9AEAB43E77D2E028EBCC123B5805644B3DC990CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d7ea1dae379c29ffec52e189587c01ef4969939e3d8e8585e02748e8a40f732c
MD5 38a3092c4c2780d7dbbea59070c4363a
SHA1 01bd1a22d79c5c6a8720f13aba17cfebf9e80a77
SHA512 a23b553b377b39b853d63ea2257c955cd7e1c5272fc8939791d82ce1d5cee006a4c026f98e7dda4865b553b131292690a683a1e3894ae497ff9862984c14507b
SSDEEP 384:FZcIhsNcrSRbFy2uGdpqblOOPrXLpe8C/rtm:9hqRoyMlOi9PWtm
TLSH
T151928D71AC786D67ADB6B641F48627039FF85137F7C42B84A6ECEB0C05DA668130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c650da3cf3ffb391c9d2b314e2bb814e0176572ff8155ed71d694dc0771f5ef
MD5 d2b828f5c1f9b141557532bb83c4041f
SHA1 5cbd4fb696e39aa0996acd3585997b5a899b260b
SHA512 e5fa3b3fcd8b7c6bbc46afce0d355b9fd0289e1170795a20313532236b04f60ebbf4de676544fbbcec384c9e15b16e94e2d50f4b86fc54bc9be2eb61f4a6d426
SSDEEP 192:MON064BAQmiUyP1CW5GBPKT++FdGsfaDkouU6:MON06eAQ8W1dpc5uU6
TLSH
T17602EA34AC756C7B9FB2AE45F4862B175FE8113BA5C51B44EAE85F1C019B64C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f857e045ce203f805b32bcdd0a988f93011af056dfe33f8bd354a6cf48281134
MD5 18b1b948946baa814cccf1d751868c51
SHA1 287c26b78c2bbb9f110422328ea6e5df2814d89a
SHA512 a087b28396cbe8890495cef4474b92bc07a95a76f3cfc8fba97b0a792fa35511ba546cfbceb12acb5d04e01641e9728d13f1fcf39ab06d8060636a58c5dd48a0
SSDEEP 384:5ZcIhsNcsSRbFy2uGdpqblOOPrXLpe8C/rtm:RhvRoyMlOi9PWtm
TLSH
T16C928E71AC786D67ADB7B641F48627039FF85137F3C42B84A6ECEB0C05DA268131781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f84e12b1b0bb4df1989ac139b9839a4ca806daaed97dfdc3fa772395ebbb5753
MD5 958c52fddfea035774c403ea63301712
SHA1 922116f58ec067c2b7917fb1e6dfdcc66027fdda
SHA512 54bb51c594ec45d37774651a39556976b80c4a9b50e7466825c83bf3a3200863f4f8b2f1dfcfcf615fd7303aae6f321d4945cd3669c64fa4413f9051de58baa6
SSDEEP 192:vON164BAQmiUyzCp5GBPKT++FdGsr2PNoWwpqEU6:vON16eA7p1dpqOlU6
TLSH
T19C12FA35AC757C2B5EA27541F48736035FA8523BEAC56B84F6EC6A1C01EF75C230681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b2cc9ad46574f92208610ea4dec4fa84c992c0ded8351e44d34eeb55e9503560
MD5 e9a0e13c1e279d9413b8a2599e47d94f
SHA1 774eb1e006db6bf5a9841f79ffe7c0e22bb0c7ab
SHA512 a7930549f011230e36de140d2c4f09cea6c3d9daa9ea248bf86b498ec39dc5c03d844261f63f5bbe55c3d5e648fccbb71707fe4b2db290a987b642b22aeb120a
SSDEEP 384:NiFPZcIHsNM8TUNTUlIR0xRbtJ2P+GdpqClOOPrXLpe8C/rtm:EFHHZwgMR/s15lOi9PWtm
TLSH
T1F1D23AF148E7993AE96EAB43E77D2E028EBCC127B5805684B3DC990CCD9617FC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 113e0c2752b16d8756d50c3435da50691b8a5ab3dc1b7e84b6a02f3ade01f3fc
MD5 43e9e94f5222fd276de857c62d6fc904
SHA1 8a80e9be04dd15d812872d83a291f05907b4cde6
SHA512 278e9aa1adbcfa59a6fb3196536dd4cf7f8fe9d604257d60323dc0082211f57ffa5cb10d43a6ed64577c73a4282e4da4acbca6aa0c1745ae3e57224b6a922d5f
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dc9885229d18b87e917f146f1d26e24e4903c7042e2f241a64aba65bfab6fe41
MD5 98a1061d717ce16bcc7cd0383b6a7d62
SHA1 6d1af75344daa01f2ca2aaf353666f6916d6d49a
SHA512 5c5d14ca4da8129ce58cc910c8056ffec7bbd08fd39d40f0223e6a22bcc629e84dee8cc3ad0d3b265dbc05f442e44928e4a2728ecc1d41a2bd8c446e9929c9a6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5b5eb6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b5eb6.TMP
Size 392B
SHA256 21b0f77e79f8a2c426baf0011ad733f0233f78491594d478e6a60bb67ef73660
MD5 d139da761a080c7422edef0c22bed511
SHA1 52e6af81dc67177f9943a7138dcac92e53496877
SHA512 21bde1f60119d54dbf196c2a3ddbad8f622440b37ba9b32a6d0a4a088bb935ba7d36bf101a03f67618193ed132ad8523ed0bc1a5386d7ba6bfdd4597e7026f9f
MD5 SHA1 SHA512

Submit Download

edce4631-d4d9-4616-80b3-850b28b12733.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\edce4631-d4d9-4616-80b3-850b28b12733.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e30e027a07f4db7af1148038fba68516310d5615bf81cf7983f9d1db975fb75
MD5 401b2bc7232d25b36695e3e2258f9835
SHA1 9a4b8263f616cee2fa238e9f9db34363270273f8
SHA512 da522510136791334d12beffe1c557bcee86f63e1fe33b63d65bd7bdffcf1195c7fede3aa64ae0b5797ed4030724f267ff5a82b71d353b3b6ce7a97141a3be3e
TLSH
T1E841D858B6FA1148B3B76E1BABF6686D587AB9371E46C45E20110E4F0662F40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download